Blockchain attacks rose 30% over the past six months, according to the report, with part of that increase tied to vulnerabilities introduced by AI-assisted coding. The warning comes as AI tools are being used more aggressively in software development, including smart contract work.
HashiCorp co-founder Mitchell Hashimoto said on X that he is watching AI-assisted development scale a “resilient catastrophe machine” dynamic across the software industry. In infrastructure engineering, the phrase refers to systems that become better at self-repair while becoming harder to understand as a whole, leaving deeper risks hidden until failure arrives at a larger scale.
Fast recovery does not mean the system is understood
His argument draws on the long-running MTBF versus MTTR debate. MTBF measures how often a system fails. MTTR measures how quickly it can be restored. Cloud-era engineering has leaned toward the second metric for years: accept that failure happens, then make recovery fast.
That logic works in elastic cloud environments and microservices, but Hashimoto argues that AI-assisted development pushes it into more dangerous territory. An AI agent may fix bugs at a speed and scale humans cannot match. That says little about whether anyone actually understands why the bug appeared, where the edge cases sit, or how one module may behave when pressure spreads across the rest of the stack.
Infrastructure history shows that the biggest failures rarely come from a single broken component. They come from many systems that each appear healthy, interact constantly, and self-correct locally while no one has a full view of the entire machine. When that machine breaks, the damage is broader than a normal outage.
Smart contracts face a sharper version of the same problem
In crypto, the report says the pattern is forming faster. Researchers tested 34 AI-assisted smart contracts, and 19 of them were successfully penetrated by AI attack models, producing simulated losses of $4.6 million.
The defect rate in AI-generated code was reported at 1.7 times that of code written manually, while deployment speed was nearly 10 times faster. Put together, those numbers suggest that potential vulnerabilities are not just increasing. They are reaching production much faster as well.
There is still some human review in the process. The report says 71% of developers do not merge AI-generated code directly. Even so, review can shrink into a narrow exercise: run the tests, check coverage, approve the change. Code may look validated in a formal sense while semantic understanding keeps slipping.
The premise behind “Code is Law” comes under pressure
Crypto has long relied on the idea that “Code is Law.” That promise depends on more than public visibility. It depends on code being readable, auditable, and genuinely understood by the people shipping it. Hashimoto’s warning is that higher test coverage does not guarantee deeper comprehension.
That gap matters more on-chain than in ordinary software. Traditional applications can patch, roll back, and restore service after something goes wrong. Smart contracts often do not have that luxury. Once funds are drained on-chain, the loss is usually irreversible, which makes MTTR a weak safety net in practice.
The report leaves the issue in stark terms: if AI-generated code that developers do not fully understand begins to control other people’s money, the trust model behind “Code is Law” starts to weaken. In that setup, users may be the ones left carrying the cost.